Privacy Policy

1. Who we are (data controller)

SKAFT. is an independent practice tracker for golfers, made and operated in Iceland by Viktor Tumi Valdimarsson, kennitala 130508-3160 (“we”, “us”, “SKAFT.”). SKAFT. is currently operated as a personal project and is not yet a registered company. If that changes in the future, this section will be updated to reflect the new legal entity.

Contact for privacy questions:

• Email: skaft@skaftgolf.com
• Instagram: @skaftgolf
• Postal address: Greniberg 11, 221 Hafnarfjörður, Iceland

For the purposes of GDPR (Reglugerð (ESB) 2016/679) and Lög um persónuvernd nr. 90/2018, Viktor Tumi Valdimarsson is the data controller of personal data you provide when using the SKAFT. mobile application.

2. What personal data we collect

We collect only what is necessary to run the app and the subscription.

Category	Examples	Source
Account	Email address, password (hashed by Supabase), user id (uuid), preferred language	You, at sign-up
Profile	Username, avatar image, golf handicap, leaderboard visibility, theme, unit system	You, in the app
Practice data	Sessions, drills logged, scores, drill notes, session notes, location type (indoor/outdoor), weather selections, handicap history	You, when you log practice
User-authored drill content	Drill name, description, setup, instructions, optional photo or video attached to a drill	You, when you author a drill
User-uploaded drill media	Photos and videos attached to any drill you're allowed to contribute to, plus the count of likes and views each item accumulates	You, when you upload; other users, when they like or view
Community suggestions	Drill-content edit suggestions, drill-media suggestions, feature-idea suggestions, and moderation reports you file against media	You, when you submit through the in-app forms
Social	Friendships, competition memberships and standings, coach–student relationships	You + other users
Coaching content	Free-text notes your coach writes about you or a specific session, and drill assignments your coach sends you (only when a coach relationship is active)	Your coach
Achievements	Which badges you have unlocked and when	App, derived from your practice data
Subscription	Subscription tier (free / Pro / Pro Coach), status, period end date, store (App Store / Play Store / promo grant), product id	Apple, Google, RevenueCat, and our own server for trials, admin grants, and club codes
Notifications	Expo push notification tokens for your device(s), and the in-app notification inbox	You, when you allow push permissions; App, when you sign in
Rate-limit + audit records	Per-user API call counts for AI features and enumeration-prone RPCs; audit-log entries for privileged actions (account deletion, Pro grants, coach access changes)	App, automatically
Device / technical	App version, OS, error logs (only when something fails)	App, automatically

We do not collect: precise location (GPS), advertising identifiers, contact list, microphone audio (except when you choose to film a drill video), camera roll (except when you pick an image), payment details (Apple/Google handle payment data; we never see your card information), or any device telemetry beyond crash logs.

3. Why we use your data (legal basis)

Purpose	Legal basis (GDPR Art. 6)
Providing the app’s core functionality (account, sessions, drills)	Performance of a contract (Art. 6(1)(b))
Operating SKAFT. Pro and SKAFT. Pro Coach subscriptions and billing	Performance of a contract (Art. 6(1)(b))
Sending essential service emails (password reset, billing-issue notice)	Performance of a contract (Art. 6(1)(b))
Friends, competitions, and coach–student relationships	Performance of a contract (Art. 6(1)(b)) — required to deliver the feature you opted into by sending or accepting the invite
Public leaderboard visibility (username, avatar, handicap, score)	Your explicit consent (Art. 6(1)(a)). Off by default. Toggle in Settings → Privacy → Show me on the leaderboard. Revocable at any time.
Publishing a user-authored drill to the community library	Your explicit consent (Art. 6(1)(a)), revocable any time
Publishing drill media (photos or videos) attached to a drill	Your explicit consent (Art. 6(1)(a)) given by uploading and confirming the upload; revocable any time by deleting the media item
Community moderation (reviewing drill-content suggestions, drill-media suggestions, and media reports)	Legitimate interest (Art. 6(1)(f)) — keeping the community library accurate and free of harmful content
Translating user-authored drill content between Icelandic and English	Performance of a contract (Art. 6(1)(b)). See §4 and §4a
Generating the weekly AI practice insight (Pro feature only)	Your explicit consent (Art. 6(1)(a)) collected in-app before the first insight is produced. See §4a
Rate-limiting AI features and enumeration-prone lookups, keeping an audit log of privileged actions	Legitimate interest (Art. 6(1)(f)) — abuse prevention, cost control, and accountability
Diagnosing crashes and errors	Legitimate interest (Art. 6(1)(f))
Complying with tax, accounting, and consumer-rights law	Legal obligation (Art. 6(1)(c))

We do not sell your personal data, use it for ad targeting, or train AI models on it. Drill text content sent for translation, and practice summaries sent for the weekly AI insight (Pro), are not used to train AI models, per the sub-processor’s commercial API policy. See §4a for full detail on AI processing.

4. Who we share data with (sub-processors)

We use the following sub-processors. Each is bound by a data-processing agreement and an adequate cross-border transfer safeguard where applicable.

Sub-processor	Purpose	Location
Supabase Inc.	Database, authentication, file storage, edge functions	EU / US (SCCs)
RevenueCat Inc.	Subscription receipt validation and entitlement state	US (SCCs)
Apple Inc.	App Store subscription billing, payment processing, transactions	US (EU-US DPF)
Google LLC	Google Play subscription billing, payment processing	US (EU-US DPF)
Expo, Inc.	App build, OTA update delivery, and the Expo Push Notification Service	US (SCCs)
Apple Push Notification service	Delivering push notifications to iOS devices	US (EU-US DPF)
Google Firebase Cloud Messaging	Delivering push notifications to Android devices	US (EU-US DPF)
Anthropic, PBC	(a) Translation of user-authored drill text between Icelandic and English, via the Claude API. (b) Weekly AI practice insight for Pro subscribers, via the Claude API. Input is not used to train Anthropic’s models. See §4a for full detail.	US (SCCs)
Spaceship, Inc.	Hosting of the marketing website at skaftgolf.com	US (SCCs)
Web3Forms	Receiving messages from the contact form on skaftgolf.com and forwarding them to skaft@skaftgolf.com	EU

We may add or change sub-processors. Material changes will be notified at least 30 days in advance via email or in-app notice. We do not transfer data outside the EEA except through the sub-processors above, each of which provides adequate safeguards under GDPR Chapter V (Standard Contractual Clauses).

4a. AI processing (Anthropic)

SKAFT. uses Anthropic, PBC (operator of Claude) for two features. Both run only when triggered by your activity inside the app, never on a continuous schedule beyond that.

• Drill translation · whenever you view a drill in a language other than the one it was authored in, the drill’s text content (name, description, setup, instructions) is sent to Anthropic so Claude can produce a translation. This is cached server-side, so subsequent viewers of the same drill in the same language do not trigger another call. This feature is available to all users, free and Pro.
• Weekly AI practice insight · once per week, if you have an active SKAFT. Pro subscription and have accepted the in-app consent prompt, we send an aggregated summary of your last ~14 days of practice: drill names, scores, category-level percentages, week-over-week deltas, your handicap, and the text of your session notes and per-drill notes. If you have an active coach, recent coach notes and pending assignments are also included.

Before sending, free-form text fields (session notes, per-drill notes, coach notes, assignment notes) are passed through an automatic redaction step that removes patterns matching email addresses, phone numbers, Icelandic kennitölur, street addresses, postcodes, and URLs. This is a defensive measure; please still avoid writing personally-identifying information in notes.

Anthropic processes both requests under their commercial Data Privacy Policy. They do not use this content to train their models. They retain prompts and responses for up to 30 days for safety review and then delete them. See anthropic.com/legal/privacy and anthropic.com/legal/commercial-terms.

The first time the weekly insight is about to run, the app shows a one-time consent prompt; declining stops all weekly-insight processing on that device. To withdraw consent later, delete and reinstall the app, or email skaft@skaftgolf.com to request your consent be cleared server-side. (A dedicated in-app toggle is planned for a future release.) Drill translation can be avoided by leaving the app’s language matched to the drill’s source language. Free-tier users do not have the weekly AI insight feature enabled and no practice data is sent to Anthropic on their behalf — only the drill translation feature applies to them.

Rate limits (currently 30 translations per user per day and 3 weekly-insight generations per user per day) are enforced server-side to cap our third-party AI spend and to make abuse recognisable.

4b. Drill media and community moderation

Any drill (built-in, community-shared, or coach-authored) can have photos or videos attached to it. Media is uploaded to Supabase Storage and served from a public storage bucket so other users of the app can see it inside the drill’s detail sheet and inside the vertical media feed.

• You control your uploads. You can delete any media item you uploaded from the media feed or from the “My media” grid on your profile at any time. Deletion removes the item from every drill it appears on and every user’s like history for it.
• Reactions to your media. Other users can like a media item and their views are counted (rate-limited to one view per session per item). The like row is stored as (user_id, media_id) and the aggregate count is displayed publicly on the item. Individual likers are not currently surfaced in the UI but the row is retained so we can enforce one-like-per-person.
• Suggestions. For any drill you didn’t author, you can propose media by uploading a photo or video to a separate “suggestions” bucket. The drill’s author (for community drills) or an administrator (for built-in drills) reviews the suggestion and either applies it or dismisses it. Dismissed suggestions are retained for our records but the file becomes unreachable from the app.
• Reporting. Any user can report a media item that appears to violate the Terms of Service. Reports flow to an administrator queue with your user id and the reason you gave. If the media is removed as a result, we retain the reason and the moderator’s outcome for our records.
• Retention on account deletion. When you delete your account, any media items you uploaded are deleted from Supabase Storage and the corresponding database rows are removed within 30 days. Like rows you created are also removed. Media items that other users uploaded to drills you authored are not affected by your account deletion — those belong to their uploaders.

5. How long we keep your data

• Account, profile, practice data · for as long as your account is active.
• User-uploaded drill media · for as long as the media item is not deleted (by you, by the drill’s author, or by a moderator after a report).
• Suggestions and reports · pending items until acted on; resolved items are retained together with their moderator outcome as a moderation record.
• Subscription records · for 7 years after the last invoice, as required by Icelandic accounting / tax law (Lög um bókhald nr. 145/1994).
• Audit log entries · 7 years alongside subscription records, since most audited actions (Pro grants, account deletion, coach access changes) are billing- or accountability-relevant.
• Server logs and error traces · typically 30 days.
• Deleted-account residuals · when you delete your account, personal data is removed within 30 days. Anonymous aggregates (e.g. peer averages used in comparison rows) may persist with no link back to you.

6. Your rights

Under GDPR and Lög um persónuvernd nr. 90/2018 you have the right to:

• Access the personal data we hold about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (“right to be forgotten”, Art. 17)
• Restriction of processing (Art. 18)
• Data portability · receive your data in machine-readable form (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time (does not affect processing already done)
• Lodge a complaint with the supervisory authority

To exercise these rights, contact skaft@skaftgolf.com. We respond within 30 days as required by Art. 12. You can also export your sessions to PDF from Profile → Export sessions, and delete your account from Profile → Settings → Delete account, which removes your personal data within 30 days.

Icelandic supervisory authority: Persónuvernd (Data Protection Authority of Iceland), Rauðarárstígur 10, 105 Reykjavík · personuvernd.is · phone: +354 510 9600.

7. Children

SKAFT. is not directed to children under 13. We do not knowingly collect or process the personal data of children under 13. If you become aware that a child under 13 has provided us with personal data, please contact skaft@skaftgolf.com and we will delete the account and associated data within 7 days. Users aged 13–18 should review this policy with a parent or guardian.

8. Security

We use industry-standard safeguards including TLS 1.2+ for all data in transit, encryption at rest by Supabase Storage and Postgres, industry-standard password hashing applied by Supabase Auth (we never see your plaintext password), row-level security so each user can only read their own private data, least-privilege service-role access, rate-limited and JWT-authenticated server endpoints, and an audit log of privileged actions (account deletion, Pro grants, coach access). No system is perfectly secure, however. If we become aware of a personal-data breach likely to result in risk to your rights, we will notify Persónuvernd within 72 hours and notify affected users by email without undue delay, in line with Art. 33–34 GDPR.

9. Cookies, analytics, and tracking

Neither the SKAFT. mobile app nor the marketing website (skaftgolf.com) uses cookies, analytics SDKs, or tracking pixels at this time. No advertising identifiers (IDFA, GAID) are read.

Push notifications

If you allow push notifications when the app asks, we store an Expo push token for each of your signed-in devices in the push_tokens table so we can route notifications to you (friend requests, competition invites, coach-relationship requests, drill-review outcomes, trial-ending reminders, daily streak and log reminders, and achievement unlocks). The token is an opaque identifier issued by Expo’s push service; it does not contain your name or any device identifier we can resolve back to advertising profiles. You can revoke it at any time by switching off Push notifications in Profile → Settings, or by revoking the OS-level permission. Tokens that come back as DeviceNotRegistered are auto-deleted on the next send.

Other tracking

If we add cookies, analytics, or any new tracking mechanism in the future, we will update this policy at least 30 days in advance and, where applicable, add an in-app consent prompt and a cookie notice to the website.

10. Changes to this policy

We may update this policy when the law, our practices, or the app changes. Material changes will be announced in-app at least 30 days before they take effect. The “Last updated” date at the top of this document always reflects the current version.

11. Governing law and disputes

This policy is governed by the laws of Iceland. Disputes are subject to the exclusive jurisdiction of the courts of Iceland (Héraðsdómur Reykjavíkur in the first instance), without prejudice to your right to lodge a complaint with Persónuvernd or any other competent supervisory authority.